A rejected e-file. A 941 you don't remember submitting. A Secretary of State annual report with a new registered agent you've never heard of. Each of these is a small, easy-to-overlook signal — and each is a classic fingerprint of business identity theft. According to the FTC, identity theft reports topped 1.1 million in 2024, and the IRS continues to treat business identity theft as a distinct, growing threat alongside personal identity theft.
Unlike consumer identity theft, business identity theft is rarely covered by a single law, a single agency, or a single insurance policy. EINs cannot be frozen the way Social Security numbers can. Business credit bureaus do not offer the same protections as Equifax, Experian, or TransUnion on the consumer side. And the IRS, your bank, your Secretary of State, and your payroll provider each operate on their own remediation track. This guide walks you through the warning signs, the immediate response steps, and the year-round defensive practices that small business owners — from sole proprietors to closely held C-corporations — can put in place this week.
How Business Identity Theft Actually Happens
Most successful business identity theft attacks rely on publicly available information. Your EIN appears on W-9s, 1099s, business filings, and sometimes on your invoices. Your registered agent, formation date, officers, and address are public via Secretary of State databases. Combine that with a stolen mailing address, a forged signed letter, or a compromised email account, and a thief has everything they need to impersonate your business.
Common attack patterns include:
- EIN-based tax fraud. Criminals file a fraudulent Form 1120, 1120-S, or 1065 in your business's name to claim refundable credits or use the return to anchor a downstream individual identity theft scheme.
- Payroll fraud. Bogus Forms 941 are filed to generate refundable credits, or a counterfeit W-2 batch is uploaded to the Social Security Administration's Business Services Online to harvest employee SSNs.
- Registered agent hijacking. A thief files an amendment with your Secretary of State changing the registered agent or principal officer. Once they control the official mailing address for service of process, they redirect government notices and can open accounts in your name.
- Bank and merchant account takeover. Phishing or credential stuffing against your business banking portal, ACH origination tool, or payment processor — often followed by quick withdrawals before you notice.
- 1099-NEC and 1099-K fabrication. Thieves issue 1099s in your name to workers you have never employed, creating fake expenses on a fraudulent return and triggering downstream IRS notices to people you don't know.
The Warning Signs You Cannot Ignore
The IRS and most fraud examiners agree on a short list of red flags. Treat any of these as a presumptive incident and start the response steps below the same day you spot them.
Tax-Side Signals
- Your e-filed return is rejected because a return for the same period already exists.
- You receive an IRS notice — CP2000, Letter 6042C, or a transcript request — referencing a return, deposit, or refund you didn't initiate.
- A routine extension request (Form 7004) is rejected as a duplicate.
- Forms W-2 you never submitted appear in your SSA Business Services Online account.
- An IRS employment tax notice references quarters you never had payroll.
- You see deposits in your IRS Business Tax Account from credits you didn't claim.
Registration and Banking Signals
- Your Secretary of State portal shows a new registered agent, new officers, or an unfamiliar address.
- You receive a renewal or amendment confirmation you didn't authorize.
- Your business credit report from Dun & Bradstreet, Experian Business, or Equifax Small Business shows new tradelines or inquiries.
- Vendors call about invoices addressed to your business that never reached you.
- Your bank flags ACH activity, new authorized users, or wire requests you didn't initiate.
Operational Signals
- Mail you expected — payroll tax notices, bank statements, vendor checks — stops arriving.
- Customers or workers receive 1099s from your EIN that you never issued.
- Your payroll provider warns about unusual login attempts or new admin users.
The First 72 Hours: Your Response Playbook
Speed matters. Most identity-theft remediation gets harder the longer fraud sits in the system. Use this rough sequence; many steps can run in parallel.
Hour 0–4: Contain the Bleeding
- Lock down credentials. Force a password reset on every account that could touch your finances: IRS Online Account, IRS Business Tax Account, EFTPS, state tax portals, business banking, ACH origination tools, merchant processors, payroll provider, Secretary of State filing portal, and email. Enable multi-factor authentication everywhere it is offered, ideally using a hardware security key or authenticator app rather than SMS.
- Document what you see. Take dated screenshots of the suspicious notice, the rejected filing, the Secretary of State record, or the bank statement. Save the original IRS letter — you will need it for Form 14039-B.
- Tell your bank immediately. Reverse any pending ACH or wire transfers if the bank's cutoff window still allows it. Ask the bank to flag the account for fraud review and to reset any positive-pay rules.
Day 1: File the Affidavits
- File IRS Form 14039-B, the Business Identity Theft Affidavit. This is the form businesses, trusts, estates, and tax-exempt organizations use when a thief is using your business name or EIN. Attach copies of the IRS notice that triggered your suspicion and any return or transcript you can obtain.
- Call the IRS Business and Specialty Tax Line at 1-800-829-4933. Ask the representative to flag your account for identity theft review and request a Letter 147C as fresh proof of your legitimate EIN if your CP575 is missing.
- File a report with the FTC at IdentityTheft.gov and obtain a recovery plan. Even though the FTC's flagship process is consumer-focused, the case ID is useful when working with banks and credit bureaus.
- File a police report with your local jurisdiction. Many state Secretary of State offices and some banks will not act on disputes without one.
Day 2: Stop the Spread
- Contact the three business credit bureaus. You cannot freeze a business credit file the way you freeze a personal credit file, but you can place fraud alerts and dispute inquiries:
- Dun & Bradstreet (D&B): request a fraud alert on your DUNS profile and verify tradelines.
- Experian Business: open a dispute and add a fraud statement.
- Equifax Small Business: request review of new accounts and inquiries.
- Notify your Secretary of State. If a thief amended your registered agent or officers, file a corrective amendment and follow your state's identity theft reporting procedure. Many states (Colorado, Florida, New York, and others) now have dedicated forms.
- Tell vendors and customers. If counterfeit invoices or fake 1099s have already been issued, a short, factual email — not a marketing blast — can prevent payments from flowing into the wrong account.
Day 3 and Beyond: Reconcile and Recover
- Reconcile fraudulent 1099s. If a fake 1099-NEC or 1099-K was issued under your EIN, write a corrected zero-dollar 1099 and document the dispute in your accounting records. Keep the IRS notice, your corrected return, and the affidavit together as a single packet.
- Replace lost mail. Audit USPS for unauthorized change-of-address requests at usps.com/manage. Consider USPS Informed Delivery so you see scans of inbound mail.
- Reset employee access. Anyone who left the company or moved roles should lose every credential they no longer need. Most business identity theft incidents involve at least one account that shouldn't have still been live.
Bookkeeping's Quiet Role in Fraud Detection
Strong bookkeeping is one of the cheapest, most effective fraud controls a small business has. A clean ledger makes anomalies visible — and visibility is the entire game in identity theft. Three habits matter most:
- Monthly reconciliation discipline. Reconcile every bank, credit card, payroll, and merchant account every month. Stale books hide unauthorized ACH transfers, ghost payroll runs, and stolen vendor payments for months at a time.
- Tight chart of accounts. Distinct accounts for tax payments, payroll liabilities, merchant deposits, and intercompany transfers make it easy to spot a number that doesn't belong. A lumped "miscellaneous" account is where fraud hides.
- Version-controlled records. When the IRS asks for documentation supporting your real Form 941 or 1120-S, you want a trail that shows when each entry was made and by whom. Tamper-evident records are gold during an identity-theft remediation.
Accurate, transparent books also shorten the time it takes to prove a return is fraudulent. The faster you can produce a clean payroll register, journal, or general ledger covering the disputed period, the faster the IRS Identity Protection Specialized Unit can close your case.
Year-Round Defensive Practices
Most of the businesses that recover quickly from identity theft are the ones that prepared before they were hit. The following habits cost very little and pay for themselves the first time something goes wrong.
Lock Down Your IRS Footprint
- Verify your identity once with ID.me and create an IRS Online Account for the business. From there you can monitor balance, transcripts, and notices proactively rather than reactively.
- Store your CP575 (the original IRS confirmation of your EIN) in a secure, redundant location. If you cannot find it, call the IRS Business and Specialty Tax Line to obtain a Letter 147C and save it.
- Pull a tax transcript at least once a year — and once each quarter if you have payroll. An unexpected wage and income transcript is often the earliest sign of payroll fraud.
Lock Down Your State Footprint
- Sign up for Secretary of State email or text alerts where they are offered. Any unsolicited annual report or amendment notification deserves a same-day review.
- Use a professional registered agent service rather than a personal address. A professional agent will flag suspicious mail and is harder to impersonate.
- Subscribe to your state's UCC filing alerts where available; phantom UCC-1 filings against your assets are a known precursor to lender fraud.
Lock Down Your Banking and Payroll Footprint
- Enable positive pay or reverse positive pay on every business checking account.
- Require dual approval for ACH origination and any wire above a low threshold (many small businesses use $1,000 or $2,500).
- Limit who has admin access in your payroll provider. Audit admin lists quarterly.
- Use hardware security keys (FIDO2/WebAuthn) on banking, payroll, and email. SMS and authenticator apps are better than passwords alone, but hardware keys defeat almost every phishing-driven account takeover.
Lock Down Your Credit and Vendor Footprint
- Subscribe to at least one business credit monitoring service. D&B's CreditSignal offers free alerts; full monitoring from D&B, Experian Business, or Nav typically runs $15 to $199 per month.
- Verify new vendor banking changes by calling a phone number you already have on file, not the one in the email asking for the change. Business email compromise scams almost always involve a "new ACH info" message.
- Standardize how you issue 1099s and keep a complete list of every payee. A controlled issuance process makes it obvious when a counterfeit 1099 appears with your EIN.
What Your Insurance Will and Will Not Cover
Most generic small business owners' policies (BOP) do not cover business identity theft. The coverage you want lives under one of three add-ons:
- Cyber liability typically covers credential theft, business email compromise, and remediation costs.
- Crime insurance can cover forged check losses, computer fraud, and funds transfer fraud, often subject to verification clauses.
- Identity recovery endorsements sometimes attach to BOP or cyber policies and reimburse legal fees, document filing fees, and lost productivity.
Read the warranty and verification clauses carefully. Many crime policies deny claims if dual authorization or call-back verification was contractually required and not performed. The control hygiene from the section above is not only good practice — it preserves your coverage.
Long-Tail Recovery Tasks Most Owners Forget
Once the immediate crisis is contained, set calendar reminders for these follow-ups; they catch the second wave of fraud that often follows the first:
- 30 days out: Pull fresh transcripts from the IRS, your state department of revenue, and your unemployment insurance account.
- 60 days out: Re-audit Secretary of State records and confirm your registered agent change is reflected.
- 90 days out: Re-pull business credit reports and confirm fraudulent inquiries and tradelines have been removed.
- One year out: Schedule an annual identity-theft review during your year-end close. It pairs naturally with reconciliations and tax-prep work.
Keep Your Books — and Your Identity — Organized From the Start
The thread tying every step of this playbook together is documentation. The faster you can produce a clean, trustworthy record of what your business actually did — payroll, returns, vendor activity, and bank transactions — the faster identity theft cases close, and the less leverage a thief has over your reputation. Beancount.io provides plain-text accounting that is transparent, version-controlled, and AI-ready, so every entry in your ledger has a clear, auditable history. Get started for free and build the kind of records that make recovery from any kind of fraud dramatically less painful.